Analysis
-
max time kernel
1957222s -
max time network
160s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
16-12-2023 22:01
General
-
Target
76aae1533f1aca39631fe0a053338850966815e808332ce67ea3c0b4cd85a174.apk
-
Size
3.5MB
-
MD5
beeec17e265835b9dfc76f076664fdfd
-
SHA1
480d53259e0950af363236f289166edca189a742
-
SHA256
76aae1533f1aca39631fe0a053338850966815e808332ce67ea3c0b4cd85a174
-
SHA512
f10b45b2949cf98d45518cc5f82f88c13ea64388f179295ef63428c0764ad617347ad30f7d8f7248fff076f580c5f78aa63f42f807227ab05cbee68dc0ba489a
-
SSDEEP
49152:EUHKPS8aJluK5r1f0LRf7XMISsO0zjoK80obeW/9X16z2yrrH7MdBylHZIFW6B:6GP3bsf78Kzjo8SeWZwz2yLC106B
Malware Config
Extracted
alienbot
http://asayratermalhotel.xyz
Extracted
alienbot
http://asayratermalhotel.xyz
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 3 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
Processes
-
garlic.picnic.hungry1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380B
MD5421b6d5c1562490f76f98c10fc1f02f8
SHA1b726d38499817006ac58df2196a257606052f1d6
SHA25662b248594289d0d5870086cc1805d723803e7aa2292cfb966d29eb7963a21758
SHA5125fa4d6d4aff7ae9415b0ddae82a54e558153d2062ffdf40f100c1c94e451e106b10869d6a372f41818f9f6d7e649b33d460f6dcc9f5372c91c1bdbc5206e54b9
-
Filesize
483KB
MD5a96ec73a6993ae5accddf47675ac5ca7
SHA163937376378c3fade65c3dd544bfc59d9a7850fd
SHA256772ca1b6b3231c91284f0e64187a47315ff5a3b81decac76600dd30b3b303e4b
SHA51277eac3a89d4985c11286c3d46fa60d057eca907c0bbfe23291aa67c671fb0b023572768152ebadc7c7a97fca93eb1a8674a737ef405d77f2fbb6acdf49dcc7d6
-
Filesize
483KB
MD57f9182268a63ef30c1ccca408a37ace8
SHA171d54110c93e7cc9038376dd0a0b6267d58577b2
SHA2569872e545d5d52bbe812541012ec6b22696850c3d15d8827ec73f18708ae1b03e
SHA512400bb73b828dd9f745fbd5f03770e6fb3db8466083477879f8da8c96e5aecd8b306654ee82d879de8a1b36b755c965fdf66942a9753b90e79a5977aa4adf09f9